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REMARKS 

The specification has been amended to correct a minor typographical error. Claims 1, 4, 
6, 14, 25, 29, 33, 43 and 61 have been amended to improve form and claims 7, 8, 16, 39, 44, 52- 
60 and 63 have been canceled without prejudice or disclaimer. Claims 1-6, 9-15, 17-38, 40-43, 
45-51, 61, 62 and 64 are now pending in this appUcation. 

Claims 1-6, 8-17, 20-28, 32-39, 41-48, 50 and 51 have been rejected under 35 U.S.C. § 
102(e) as being anticipated by Goldstone (U.S. Patent Publication No. 2002/0101819); claims 
52-57 and 59-64 have been rejected under 35 U.S.C. § 102(e) as being anticipated by Chen et al. 
(U.S. Patent Publication No. 2002/0032854; hereinafter Chen); claims 7, 18, 29 and 40 have 
been rejected under 35 U.S.C. § 103(a) as being unpatentable over Goldstone in view of 
Khosravi et al (U.S. Patent Publication No. 2003/0039245; hereinafter Khosravi); and claims 19, 
30, 31, 49 and 58 have been rejected under 35 U.S.C. § 103(a) as being unpatentable over 
Goldstone in view of Chen and fiirther in view of Nguyen et al. (U.S. Patent Publication No. 
2002/0016926; hereinafter Nguyen). The rejections are respectfiiUy traversed. 

Claims 1-6, 8-17, 20-28, 32-39, 41-48, 50 and 51 have been rejected under 35 U.S.C. § 
102(e) as being anticipated by Goldstone (U.S. Patent Publication No. 2002/0101819). The 
rejection is respectfiilly traversed. 

Claim 1 recites a system for detecting and responding to an attack that includes a first 
device attached to a network and configured to detect an attack based on received traffic and 
create attack information. Claim 1, as amended, also recites that the first device is configured to 
forward the attack information to the network using a link state routing protocol or a path vector 
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routing protocol. A similar feature was previously recited in claim 7. As to this feature, the 
Office Action admits that Goldstone does not disclose this feature, but states that the link state 
protocol is a well known standard protocol used in router-to-router communication as is evident 
from Khosravi and points to paragraph 52, lines 1-15 of Khosravi (Office Action - page 14). 
The Office Action further states that it would have been obvious to use a link state routing 
protocol as an alternative to the routing protocol of Goldstone (Office Action - page 14). The 
applicant respectfully disagrees. 

While the link state routing protocol may be a well known protocol, using the link state 
routing protocol to forward attack information is not well known. Khosravi at paragraph 52 
merely discloses using a link state routing protocol to communicate routing information between 
routers. The applicant respectfully submits that transmitting attack information using a link state 
routing protocol or a path vector routing protocol is significantly different than using a link state 
routing protocol in the maimer it was intended to be used (i.e., to transmit routing information). 
As discussed in the applicant's specification at paragraph 73, for example, advertising attack 
information using such a routing protocol enables the attack information to be sent without 
having to design/use a special purpose flooding mechanism. This greatly simplifies the process 
for advertising attack information and enables the information to be communicated in an efficient 
manner. Neither Goldstone nor Khosravi suggests using a link state routing protocol or a path 
vector routing protocol to forward attack information, as required by amended claim 1 . 

For at least these reasons, withdrawal of the rejection and allowance of claim 1 are 
respectfully requested. 
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Claims 2-6 and 9-13 are dependent on claim 1 and are believed to be allowable for at 
least the reasons claim 1 is allowable. In addition, these claims recite additional features not 
disclosed by the cited art. 

For example, claim 2 recites that the first device comprises a firewall filter. Goldstone 
may disclose using a firewall to detect an attack. Goldstone, however, does not disclose that the 
firewall filter is able to forward attack information using a link state routing protocol or a path 
vector routing protocol. Khosravi, as discussed above, discloses that routers may use a link state 
routing protocol to communicate. Khosravi, however, does not disclose that a firewall filter may 
use such a protocol. Further, as discussed in the applicant's specification at, for example, 
paragraph 80, conventional firewalls, such as the firewall in Goldstone, are not equipped to 
handle routing protocols. Therefore, even if routing protocols are known, it is not conventional 
or obvious for a firewall filter to communicate using either a link state routing protocol or a path 
vector routing protocol, as required by claim 2. 

For at least these additional reasons, withdrawal of the rejection and allowance of claim 2 
are respectfully requested. 

Claims 14 and 25, as amended, recite features similar to, but not identical to claim 1. For 
reasons similar to those discussed above with respect to claim 1, the combination of Goldstone 
and Khosravi does not disclose or suggest each of the features of amended claims 14 and 25. 
Accordingly, withdrawal of the rejection and allowance of claims 14 and 25 are respectfully 
requested. 
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Claims 15, 17, 18, 20-24, 26-29 and 32 variously depend on claims 14 and 25 and are 
believed to be allov^able for at least the reasons claims 14 and 25 are allowable. Accordingly, 
withdrawal of the rejection and allowance of claims 15, 17, 18, 20-24, 26-29 and 32 are 
respectfully requested. 

Claim 33 recites a method of detecting an attack that includes monitoring incoming 
traffic at a first device to detect an attack and generating attack information defining 
characteristics of the attack. Claim 33, as amended, also recites transmitting the attack 
information to a second device via a network using a link state routing protocol, a path vector 
routing protocol, a markup language protocol or a hypertext protocol. Similar to the discussion 
above with respect to claim 1, neither Goldstone nor Khosravi discloses or suggest using link 
state routing protocol or a path vector routing protocol to transmit attack information. In 
addition, neither of these references discloses or suggests using a markup language protocol or a 
hypertext protocol to transmit attack information. 

For at least these reasons, the combination of Goldstone and Khosravi does not disclose 
or suggest each of the features of amended claim 33. Accordingly, withdrawal of the rejection 
and allowance of claim 33 are respectfiiUy requested. 

Claims 34-38 and 40-42 depend on claim 33 and are believed to be allowable for at least 
the reasons claim 33 is allowable. Accordingly, withdrawal of the rejection and allowance of 
claims 34-38 and 40-42 are respectfiiUy requested. 

Claim 43, as amended, recites features similar to, but not identical to claim 33. For 
reasons similar to those discussed above with respect to claim 33, the combination of Goldstone 

17 



Application Serial No. 10/080,865 
Attorney Docket No. 0023-0162 

and Khosravi does not disclose or suggest each of the features of amended claim 43. 
Accordingly, withdrawal of the rejection and allowance of claim 43 are respectfully requested. 

Claims 45-48, 50 and 51 depend on claim 43 and are believed to be allowable for at least 
the reasons claim 43 is allowable. Accordingly, withdrawal of the rejection and allowance of 
claims 45-48, 50 and 51 are respectfully requested. 

Claims 52-57 and 59-64 have been rejected under 35 U.S.C. § 102(e) as being anticipated 
by Chen. The rejection is respectfully traversed. 

Claim 52-57, 59 and 60 have hereby been canceled without prejudice or disclaimer, 
thereby rendering the rejection of these claims moot. 

Claim 61 recites a method for responding to an attack that includes receiving attack 
information at a central management system firom a first device via a network and managing a 
response to the attack at the central management system. Claim 61, as amended, also recites 
receiving, at the central management system, additional attack information from other devices via 
the network and communicating, by the central management system, information associated with 
the additional attack information to the first device. 

As to claim 61, the Office Action states that Chen discloses that server 101 is equivalent 
to the central management system recited in claim 61 . The Office Action also states that Chen 
discloses managing a response to an attack at the central management system and points to Chen 
at paragraph 45 for support (Office Action - page 12). Chen at paragraph 45 discloses that edge 
router 102 creates duplicate programs of itself and forwards these duplicate programs to routers 
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106, 107, 109 and 1 1 1. Routers 106, 107, 109 and 1 1 1 then stop traffic fi-om attack hosts 113, 
1 14, 1 16 and 117 from reaching server 101 . 

Chen, however, does not disclose or suggest that server 101 receives additional attack 
information from other devices via the netv^ork and communicates information associated with 
the additional attack information to one of routers 106, 107, 109 and 1 1 1, as would be required 
by amended claim 61 . 

For at least these reasons, Chen does not disclose or suggest each of the features of 
amended claim 61. Accordingly, withdrawal of the rejection and allowance of claim 61 are 
respectfully requested. 

Claims 62 and 64 depend on claim 61 and are believed to be allowable for at least the 
reasons claim 61 is allowable. Accordingly, withdrawal of the rejection and allowance of claims 
62 and 64 are respectfixlly requested. 

Claims 19, 30, 31, 49 and 58 have been rejected under 35 U.S.C. § 103(a) as being 
unpatentable over Goldstone in view of Chen and further in view of Nguyen. The rejection is 
respectfully traversed. 

Claim 58 has hereby been canceled without prejudice or disclaimer, thereby rendering the 
rejection of this claim moot. 

Claims 19, 30, 31 and 49 variously depend on claims 14, 25 and 43. These claims are 
believed to be allowable for at least the reasons their respective independent claims are 
allowable. Chen and Nguyen do not remedy the deficiencies in Goldstone (or Goldstone and 
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Khosravi) discussed above with respect to claims 14, 25 and 43. Accordingly, withdrawal of the 
rejection and allowance of claims 14, 25 and 43 are respectfully requested. 
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CONCLUSION 

In view of the foregoing amendments and remarks, the applicant respectfully requests 
withdrawal of the outstanding rejection and the timely allowance of this application. 

To the extent necessary, a petition for an extension of time under 37 C.F.R. § 1 .136 is 
hereby made. Please charge any shortage in fees due in connection with the filing of this paper, 
including extension of time fees, to Deposit Account 50-1070 and please credit any excess fees 
to such deposit account. 



Date: February 16, 2006 

1 1350 Random Hills Road 
Suite 600 

Fairfax, VA 22030 
Telephone: (571)432-0800 
Facsimile: (571) 432-0808 



Respectfully submitted. 



HARRITY SNYDER, L.L.P. 




Glenn Snyder 
Reg. No. 41,428 
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